ClamAV hangs server

Forum for things that doesn't really have anything to do with hMailServer. Such as php.ini, beer, etc etc.
Post Reply
User avatar
RvdH
Senior user
Senior user
Posts: 658
Joined: 2008-06-27 14:42
Location: Netherlands

ClamAV hangs server

Post by RvdH » 2019-02-15 09:05

Yesterday ClamAV has hung the SMTP traffic on our server for a unknown reason, it seem to have started after ClamAV correctly reloaded Databases
After that (21:06) almost no SMTP traffic was possible until about an hour later (22:09) when ClamAV detected a Database modification but could not correctly reloaded Databases which resulted in a ClamAV crash with ERROR: reload db failed: Can't allocate memory
After the ClamAV Crash, ClamAV restarted itself (22:11) and everything was normal and functioning properly again

Anyone eve experienced something like this?

hmailserver error logs:

Code: Select all

"ERROR"	6048	"2019-02-14 21:26:33.588"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:26:33.588"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6940	"2019-02-14 21:35:08.393"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:35:08.393"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	5236	"2019-02-14 21:36:00.280"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:36:00.280"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	5236	"2019-02-14 21:36:19.970"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:36:19.970"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	5236	"2019-02-14 21:38:10.821"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:38:10.821"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6048	"2019-02-14 21:39:25.945"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:39:25.945"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6048	"2019-02-14 21:39:37.955"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:39:37.955"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3836	"2019-02-14 21:39:40.669"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	696	"2019-02-14 21:39:40.669"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3132	"2019-02-14 21:39:59.900"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2532	"2019-02-14 21:39:59.900"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	7900	"2019-02-14 21:42:01.873"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2532	"2019-02-14 21:42:01.873"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2476	"2019-02-14 21:42:05.347"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	696	"2019-02-14 21:42:05.347"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2476	"2019-02-14 21:42:09.314"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:42:09.314"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2756	"2019-02-14 21:43:19.727"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:43:19.727"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6048	"2019-02-14 21:43:44.464"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:43:44.464"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6576	"2019-02-14 21:44:47.568"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:44:47.568"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	8172	"2019-02-14 21:45:21.738"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:45:21.738"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2476	"2019-02-14 21:46:26.442"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:46:26.442"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6576	"2019-02-14 21:46:40.076"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	696	"2019-02-14 21:46:40.076"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6048	"2019-02-14 21:47:01.476"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:47:01.476"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3436	"2019-02-14 21:49:27.537"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:49:27.537"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	8172	"2019-02-14 21:49:28.348"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	696	"2019-02-14 21:49:28.348"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3132	"2019-02-14 21:49:28.380"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:49:28.380"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6576	"2019-02-14 21:51:57.085"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	552	"2019-02-14 21:51:57.085"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2476	"2019-02-14 21:52:01.519"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	696	"2019-02-14 21:52:01.519"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	8172	"2019-02-14 21:52:10.331"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:52:10.331"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3436	"2019-02-14 21:52:10.346"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:52:10.346"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3132	"2019-02-14 21:57:01.504"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:57:01.504"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3836	"2019-02-14 21:57:53.205"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 21:57:53.205"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	8172	"2019-02-14 21:59:32.331"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 21:59:32.331"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	6576	"2019-02-14 22:02:04.793"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 22:02:04.793"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3836	"2019-02-14 22:02:35.336"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 22:02:35.336"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	2476	"2019-02-14 22:05:05.749"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 22:05:05.749"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3836	"2019-02-14 22:07:01.254"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 22:07:01.254"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3132	"2019-02-14 22:07:49.069"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	2364	"2019-02-14 22:07:49.069"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3836	"2019-02-14 22:09:13.198"	"Severity: 3 (Medium), Code: HM5157, Source: SpamAssassinClient::OnReadError, Description: There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 121. Enable debug logging to retrieve more information regarding this problem. The problem could be that SpamAssassin is malfunctioning."
"ERROR"	7308	"2019-02-14 22:09:13.198"	"Severity: 2 (High), Code: HM5508, Source: SpamAssassinTestConnect::TestConnect, Description: The SpamAssassin tests did not complete. Please confirm that the configuration (host name and port) is valid and that SpamAssassin is running."
"ERROR"	3844	"2019-02-14 22:09:41.910"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	8136	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	3576	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	2212	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	48	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	6500	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	4828	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	2720	"2019-02-14 22:09:41.925"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	2124	"2019-02-14 22:09:41.941"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	7780	"2019-02-14 22:09:41.941"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to read STREAM command response."
"ERROR"	8136	"2019-02-14 22:09:43.944"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2720	"2019-02-14 22:09:43.975"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	7780	"2019-02-14 22:09:44.069"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	6500	"2019-02-14 22:09:44.069"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3844	"2019-02-14 22:09:44.100"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2212	"2019-02-14 22:09:44.131"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	4828	"2019-02-14 22:09:44.131"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2124	"2019-02-14 22:09:44.162"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:44.802"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3576	"2019-02-14 22:09:45.457"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2720	"2019-02-14 22:09:46.034"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	7780	"2019-02-14 22:09:46.112"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3844	"2019-02-14 22:09:46.128"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	4828	"2019-02-14 22:09:46.159"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2124	"2019-02-14 22:09:46.190"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:47.383"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3576	"2019-02-14 22:09:47.477"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2212	"2019-02-14 22:09:47.713"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3844	"2019-02-14 22:09:48.149"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	6500	"2019-02-14 22:09:48.352"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	8136	"2019-02-14 22:09:48.352"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2720	"2019-02-14 22:09:48.368"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	4828	"2019-02-14 22:09:48.399"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2124	"2019-02-14 22:09:48.524"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:49.470"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3576	"2019-02-14 22:09:49.501"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2212	"2019-02-14 22:09:49.766"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	7780	"2019-02-14 22:09:49.766"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3844	"2019-02-14 22:09:50.328"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	8136	"2019-02-14 22:09:50.515"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	6500	"2019-02-14 22:09:50.515"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	4828	"2019-02-14 22:09:50.515"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2720	"2019-02-14 22:09:50.515"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	2124	"2019-02-14 22:09:50.578"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3576	"2019-02-14 22:09:51.530"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:51.530"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	7780	"2019-02-14 22:09:52.045"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	3844	"2019-02-14 22:09:52.403"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:53.589"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	48	"2019-02-14 22:09:55.633"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
"ERROR"	6500	"2019-02-14 22:10:16.271"	"Severity: 3 (Medium), Code: HM5406, Source: ClamAVVirusScanner::Scan, Description: Unable to connect to ClamAV server at localhost:3310."
clamd log

Code: Select all

Thu Feb 14 21:06:10 2019 -> Database correctly reloaded (6937328 signatures)
Thu Feb 14 21:06:10 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:06:12 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:06:14 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:06:15 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:12:49 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:12:52 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:18:03 2019 -> SelfCheck: Database status OK.
Thu Feb 14 21:22:39 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:24:33 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:26:34 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:30:46 2019 -> SelfCheck: Database status OK.
Thu Feb 14 21:30:46 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:32:39 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:33:08 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:35:09 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:36:01 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:36:21 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:38:11 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:39:27 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:39:38 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:39:41 2019 -> ERROR: pthread_create failed
Thu Feb 14 21:49:41 2019 -> SelfCheck: Database status OK.
Thu Feb 14 21:59:41 2019 -> SelfCheck: Database status OK.
Thu Feb 14 22:09:41 2019 -> SelfCheck: Database modification detected. Forcing reload.
Thu Feb 14 22:09:41 2019 -> Reading databases from c:\clamav\db
Thu Feb 14 22:09:41 2019 -> ERROR: reload db failed: Can't allocate memory
Thu Feb 14 22:09:41 2019 -> Terminating because of a fatal error.
Thu Feb 14 22:09:41 2019 -> Pid file removed.
Thu Feb 14 22:09:41 2019 -> --- Stopped at Thu Feb 14 22:09:41 2019
Thu Feb 14 22:10:42 2019 -> +++ Started at Thu Feb 14 22:10:42 2019
Thu Feb 14 22:10:42 2019 -> Received 0 file descriptor(s) from systemd.
Thu Feb 14 22:10:42 2019 -> clamd daemon 0.101.1 (OS: win32, ARCH: i386, CPU: i386)
Thu Feb 14 22:10:42 2019 -> Log file size limited to 1048576 bytes.
Thu Feb 14 22:10:42 2019 -> Reading databases from c:\clamav\db
Thu Feb 14 22:10:42 2019 -> Not loading PUA signatures.
Thu Feb 14 22:10:42 2019 -> Bytecode: Security mode set to "TrustSigned".
Thu Feb 14 22:11:02 2019 -> Loaded 6937445 signatures.
Thu Feb 14 22:11:04 2019 -> TCP: Bound to [127.0.0.1]:3310
Thu Feb 14 22:11:04 2019 -> TCP: Setting connection queue length to 200
Thu Feb 14 22:11:04 2019 -> Limits: Global size limit set to 104857600 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: File size limit set to 26214400 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: Recursion level limit set to 16.
Thu Feb 14 22:11:04 2019 -> Limits: Files limit set to 10000.
Thu Feb 14 22:11:04 2019 -> Limits: MaxEmbeddedPE limit set to 10485760 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: MaxHTMLNormalize limit set to 10485760 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: MaxHTMLNoTags limit set to 2097152 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: MaxScriptNormalize limit set to 5242880 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: MaxZipTypeRcg limit set to 1048576 bytes.
Thu Feb 14 22:11:04 2019 -> Limits: MaxPartitions limit set to 50.
Thu Feb 14 22:11:04 2019 -> Limits: MaxIconsPE limit set to 100.
Thu Feb 14 22:11:04 2019 -> Limits: MaxRecHWP3 limit set to 16.
Thu Feb 14 22:11:04 2019 -> Limits: PCREMatchLimit limit set to 100000.
Thu Feb 14 22:11:04 2019 -> Limits: PCRERecMatchLimit limit set to 2000.
Thu Feb 14 22:11:04 2019 -> Limits: PCREMaxFileSize limit set to 26214400.
Thu Feb 14 22:11:04 2019 -> Archive support enabled.
Thu Feb 14 22:11:04 2019 -> AlertExceedsMax heuristic detection disabled.
Thu Feb 14 22:11:04 2019 -> Heuristic alerts enabled.
Thu Feb 14 22:11:04 2019 -> Portable Executable support enabled.
Thu Feb 14 22:11:04 2019 -> ELF support enabled.
Thu Feb 14 22:11:04 2019 -> Mail files support enabled.
Thu Feb 14 22:11:04 2019 -> OLE2 support enabled.
Thu Feb 14 22:11:04 2019 -> PDF support enabled.
Thu Feb 14 22:11:04 2019 -> SWF support enabled.
Thu Feb 14 22:11:04 2019 -> HTML support enabled.
Thu Feb 14 22:11:04 2019 -> XMLDOCS support enabled.
Thu Feb 14 22:11:04 2019 -> HWP3 support enabled.
Thu Feb 14 22:11:04 2019 -> Self checking every 600 seconds.
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

User avatar
RvdH
Senior user
Senior user
Posts: 658
Joined: 2008-06-27 14:42
Location: Netherlands

Re: ClamAV hangs server

Post by RvdH » 2019-02-15 09:09

FYI: I have both VirusScan and Spam checking Maximums set to: 2048 for Maximum message size to virus scan (KB) in hmailServer

Now i think of it, isn't it a bit of waste of resources on the server to use both ClamAV in hmailserver and enable clamav.pm in SpamAssassin?
Each message is checked twice that way i think, right?

I disabled clamav.pm for now... as looking at the logs i believe it was SpamAssassin clamav.pm that started the trouble... The WinSock error code is 121 :!: :?:
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

User avatar
jimimaseye
Moderator
Moderator
Posts: 7864
Joined: 2011-09-08 17:48

Re: ClamAV hangs server

Post by jimimaseye » 2019-02-15 10:11

My thoughts and observations:

Yes, I was going to point out that the initial logs show the error was with SA (as you have already noticed). I know that Mattg user the clamav.pm for helping with his scoring system but yes it does mean that all messages are scanned twice. I guess you only need it if you you are putting you virus removals in the hands of the SA scoring system and therefore do not need the AV check. (Personally I dont see the point but that's just my preference).

Ive checked my system and there were no issues yesterday at all. BUT.......

....I am mindful that I have yet NOT allowed this months windows updates (I now wait some weeks to see other peoples experiences). You will remember we got burnt last year by that update that rendered to service useless when trying to stop it and the update need backing out (and patching by Microsoft). So could it be a similar thing happening here? Did you have windows updates go through this week and therefore could that be the cause (with it being a winsock error)?
HMS 5.6.6 B2383 on Win Server 2008 R2 Foundation, + 5.6.7-B2415 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

User avatar
RvdH
Senior user
Senior user
Posts: 658
Joined: 2008-06-27 14:42
Location: Netherlands

Re: ClamAV hangs server

Post by RvdH » 2019-02-15 11:20

Yes, I installed updates this week...yesterday after 23:00, so that can't be the issue ;)
I have enabled debug login for clamd for the time being...lets see what happens

Btw, memory usage on this particular server is almost constantly somewhere between 80 and 84%, could it be a lack of free memory?

EDIT: ah...maybe it is related to this reported problems
https://lists.gt.net/clamav/users/73856#73856
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

User avatar
SorenR
Senior user
Senior user
Posts: 3003
Joined: 2006-08-21 15:38
Location: Denmark

Re: ClamAV hangs server

Post by SorenR » 2019-02-15 14:54

Just for the record, I'm still on 0.99.2 and the following SaneSecurity extensions..

Code: Select all

rsync://rsync.sanesecurity.net/sanesecurity;phish.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;rogue.hdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;sanesecurity.ftm;N;N;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;sigwhitelist.ign2;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;blurl.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;malwarehash.hsb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;hackingteam.hsb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;foxhole_generic.cdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;foxhole_filename.cdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;foxhole_js.cdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;winnow_malware.hdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;winnow_malware_links.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;winnow_extended_malware.hdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;winnow_extended_malware_links.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;scamnailer.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;crdfam.clamav.hdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;bofhland_cracked_URL.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;bofhland_malware_URL.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;bofhland_phishing_URL.ndb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;bofhland_malware_attach.hdb;N;Y;Y;N;N
rsync://rsync.sanesecurity.net/sanesecurity;phishtank.ndb;N;Y;Y;N;N
No problems with database for at least 3 months back.

I too use ClamAV via SpamAssassin and must admit that I am thinking of killing ClamAV via hMailServer as 99% of my ClamAV hits come via SpamAssassin.

Looking at the ClamAV logs I see "stream" and "instream" connections so I presume hMailServer and SpamAssassin connect differently.

On a side note... Something must have changed as (still on hMail 5.4.2) when ClamAV fails on my server all I get is a note in the log and that's it. Does not block SMTP, it just don't get checked ;-)
SørenR.

The quantum rule of insecurity which states that the act of observing how vulnerable a host or service is changes the insecurity level of the service.

User avatar
jimimaseye
Moderator
Moderator
Posts: 7864
Joined: 2011-09-08 17:48

Re: ClamAV hangs server

Post by jimimaseye » 2019-02-15 15:37

I'm on 0.99.4 and can't say in aware of any problems... ever. (Caveat: my logging is minimal and i don't look at my server much)

[Entered by mobile. Excuse my spelling.]
HMS 5.6.6 B2383 on Win Server 2008 R2 Foundation, + 5.6.7-B2415 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

palinka
Senior user
Senior user
Posts: 624
Joined: 2017-09-12 17:57

Re: ClamAV hangs server

Post by palinka » 2019-02-15 19:10

SorenR wrote:
2019-02-15 14:54
I too use ClamAV via SpamAssassin and must admit that I am thinking of killing ClamAV via hMailServer as 99% of my ClamAV hits come via SpamAssassin.
Does SA delete the attachment? I thought it just assigned a score. I rather prefer the slightly safer road of deleting the attachment. I changed my settings from hmailserver delete message to delete attachment after I added clamav scoring to SA. I wanted to see how it works (SA reason in message headers). It works but I don't believe it deletes anything - just gives the message a score.

User avatar
RvdH
Senior user
Senior user
Posts: 658
Joined: 2008-06-27 14:42
Location: Netherlands

Re: ClamAV hangs server

Post by RvdH » 2019-02-15 20:07

palinka wrote:
2019-02-15 19:10
SorenR wrote:
2019-02-15 14:54
I too use ClamAV via SpamAssassin and must admit that I am thinking of killing ClamAV via hMailServer as 99% of my ClamAV hits come via SpamAssassin.
Does SA delete the attachment? I thought it just assigned a score. I rather prefer the slightly safer road of deleting the attachment. I changed my settings from hmailserver delete message to delete attachment after I added clamav scoring to SA. I wanted to see how it works (SA reason in message headers). It works but I don't believe it deletes anything - just gives the message a score.
If you score it high enough in ClamAV.cf and the message total score is above the Spam delete threshold in hmailserver the mail in question doesn't get thru at all :lol:

@soren
I think the stalling of SMTP is caused by The WinSock error code is 121
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

palinka
Senior user
Senior user
Posts: 624
Joined: 2017-09-12 17:57

Re: ClamAV hangs server

Post by palinka » 2019-02-15 20:16

RvdH wrote:
2019-02-15 20:07
If you score it high enough in ClamAV.cf and the message total score is above the Spam delete threshold in hmailserver the mail in question doesn't get thru at all :lol:
Sorry, I should have mentioned that I set hmailserver delete threshold to 8,000. I forward all spam to myself for sorting. But, yes, ordinarily the message would be deleted based on high > delete threshold score.

User avatar
SorenR
Senior user
Senior user
Posts: 3003
Joined: 2006-08-21 15:38
Location: Denmark

Re: ClamAV hangs server

Post by SorenR » 2019-02-15 22:16

palinka wrote:
2019-02-15 19:10
SorenR wrote:
2019-02-15 14:54
I too use ClamAV via SpamAssassin and must admit that I am thinking of killing ClamAV via hMailServer as 99% of my ClamAV hits come via SpamAssassin.
Does SA delete the attachment? I thought it just assigned a score. I rather prefer the slightly safer road of deleting the attachment. I changed my settings from hmailserver delete message to delete attachment after I added clamav scoring to SA. I wanted to see how it works (SA reason in message headers). It works but I don't believe it deletes anything - just gives the message a score.
ClamAV via hMailServer = email tagged with "* VIRUS *" in INBOX - without attachment.
ClamAV via SpamAssassin = email tagged with "* VIRUS *" in SPAM folder - with attachment.

SPAM score >= 3.
All SPAM is copied to SPAMTrap user.
SPAM scored above 6 is deleted from normal user.
Remaining SPAM is moved to SPAM folder.
SørenR.

The quantum rule of insecurity which states that the act of observing how vulnerable a host or service is changes the insecurity level of the service.

palinka
Senior user
Senior user
Posts: 624
Joined: 2017-09-12 17:57

Re: ClamAV hangs server

Post by palinka » 2019-02-15 22:36

SorenR wrote:
2019-02-15 22:16
ClamAV via hMailServer = email tagged with "* VIRUS *" in INBOX - without attachment.
ClamAV via SpamAssassin = email tagged with "* VIRUS *" in SPAM folder - with attachment.
That's what I thought. 👍

User avatar
jimimaseye
Moderator
Moderator
Posts: 7864
Joined: 2011-09-08 17:48

Re: ClamAV hangs server

Post by jimimaseye » 2019-02-15 23:30

And this is partly why i personally don't like the ideas of this: a virus is unwanted. No ifs or buts. Why keep it attached for the potential of being opened? Why not have it deleted immediately and be done.

Argument: "because of false positives"

Response: how often? And and given the rarity, is that 1 in 1000 chance worth the risk of the other 999 being inadvertently opened?

[Entered by mobile. Excuse my spelling.] (And up the pub) 🤪
HMS 5.6.6 B2383 on Win Server 2008 R2 Foundation, + 5.6.7-B2415 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

palinka
Senior user
Senior user
Posts: 624
Joined: 2017-09-12 17:57

Re: ClamAV hangs server

Post by palinka » 2019-02-16 15:36

jimimaseye wrote:
2019-02-15 23:30
And this is partly why i personally don't like the ideas of this: a virus is unwanted. No ifs or buts. Why keep it attached for the potential of being opened? Why not have it deleted immediately and be done.

Argument: "because of false positives"

Response: how often? And and given the rarity, is that 1 in 1000 chance worth the risk of the other 999 being inadvertently opened?

[Entered by mobile. Excuse my spelling.] (And up the pub) 🤪
Right on. The good thing about deleting the attachment and still delivering the message is in the extremely rare case a false positive gets through, the user will know and be able to inquire why. And you're still safe in case it wasn't a false positive at all.

User avatar
mattg
Moderator
Moderator
Posts: 19648
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: ClamAV hangs server

Post by mattg » 2019-02-17 00:45

A little while back I changed my Spam routine.

I used to reject all above about 15 on my system, catch all 7-15 in Quarantine, and pass 6 and under (I have fairly high scores and deliberately inflate SpamAssassin Scores)

Now I accept and quarantine everything from 7 and up, with an account level rule that simply deletes the scores of 15 and above. This is to limit the backscatter emanating from my machine.

Because I now accept this mail in Spam terms, the messages get AV scanned which wasn't happening when I was rejecting large spam scores. This means that before the message gets deleted the attachment also gets removed first for anything that triggers the SaneSecurity list,

I have double AV on my server anyway, and CLAM only seems to find stuff with the SaneSecurity defs, so I'm thinking that I may not send all accepted mail through ClamAV direct from hMailserver.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
jimimaseye
Moderator
Moderator
Posts: 7864
Joined: 2011-09-08 17:48

Re: ClamAV hangs server

Post by jimimaseye » 2019-02-19 00:57

jimimaseye wrote:
2019-02-15 15:37
I'm on 0.99.4 and can't say in aware of any problems... ever. (Caveat: my logging is minimal and i don't look at my server much)

[Entered by mobile. Excuse my spelling.]
:oops: :oops: :oops: Oops.

Ive just checked my system. My Clam database hasnt updated since February 4th and nor has my nightly scheduled scan of the system. Very weird. I might have stopped/deleted the Clamtray process by mistake but didnt realise it.

That'll teach me.
HMS 5.6.6 B2383 on Win Server 2008 R2 Foundation, + 5.6.7-B2415 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

User avatar
SorenR
Senior user
Senior user
Posts: 3003
Joined: 2006-08-21 15:38
Location: Denmark

Re: ClamAV hangs server

Post by SorenR » 2019-02-20 15:34

mattg wrote:
2019-02-17 00:45
A little while back I changed my Spam routine.

I used to reject all above about 15 on my system, catch all 7-15 in Quarantine, and pass 6 and under (I have fairly high scores and deliberately inflate SpamAssassin Scores)

Now I accept and quarantine everything from 7 and up, with an account level rule that simply deletes the scores of 15 and above. This is to limit the backscatter emanating from my machine.

Because I now accept this mail in Spam terms, the messages get AV scanned which wasn't happening when I was rejecting large spam scores. This means that before the message gets deleted the attachment also gets removed first for anything that triggers the SaneSecurity list,

I have double AV on my server anyway, and CLAM only seems to find stuff with the SaneSecurity defs, so I'm thinking that I may not send all accepted mail through ClamAV direct from hMailserver.
I got inspired ...

The "Disconnect(oClient.IPAddress)" thingy is a 30 second wait followed by the good old cPorts by Nirsoft.

No Backscatter AND no SPAM mails :mrgreen:
The ONLY situation I respond with a 550 is mail from a banned server/IP Range delivered via my Backup-MX.

The short ban time is an experiment to keep my ban-list short(er).

Code: Select all

   '
   '   Check SMTP traffic
   '
   If (InStr("|25|587|465|", oClient.Port) > 0) Then
      '
      '   SnowShoe SPAM detection
      '
      If IsSnowShoe(oClient.IPAddress) Then
         Call AutoBan(oClient.IPAddress, "SnowShoe", 12, "h")
         Disconnect(oClient.IPAddress)
         Exit Sub
      End If
      '
      '   LashBack SPAM detection
      '
      If IsLashBack(oClient.IPAddress) Then
         Call AutoBan(oClient.IPAddress, "LashBack", 12, "h")
         Disconnect(oClient.IPAddress)
         Exit Sub
      End If
      '
      '   Filter out "impatient" servers. Alternative to GreyListing.
      '
      If (oClient.Port = 25) Then Wait(20)
   End If
SørenR.

The quantum rule of insecurity which states that the act of observing how vulnerable a host or service is changes the insecurity level of the service.

rob2k2
New user
New user
Posts: 19
Joined: 2013-12-12 03:07

Re: ClamAV hangs server

Post by rob2k2 » 2019-05-25 21:55

This one Ever solved?

I'm having same issue i think..

In my Clamd.log file.. i get this.. after it runs for 20 - 30 days usually.. It stop the delievery queue in hmailserver.. and mails just queue up..

SelfCheck: Database status OK.
ERROR: pthread_create failed
ERROR: pthread_create failed

Here is my post.. https://www.hmailserver.com/forum/viewt ... =7&t=33950

Post Reply